- cypherpunks-legacy - lists.cpunks.org

CFP '96
by Rev. Ben 17 Dec '03

17 Dec '03

I'm going to CFP '96 and was wondering if any cpunks wanted to share a hotel room with me(or even better, offer me crash space on the floor). If so, mail me and we'll work something out. And now back to your regularly scheduled rants and GAK'ing. Ben. ____ Ben Samman..............................................samman(a)cs.yale.edu "If what Proust says is true, that happiness is the absence of fever, then I will never know happiness. For I am possessed by a fever for knowledge, experience, and creation." -Anais Nin PGP Encrypted Mail Welcomed Finger samman(a)powered.cs.yale.edu for key

1 0

Re: GAK_hit
by Mark Neely 17 Dec '03

17 Dec '03

> I've heard that when a machine that already has Internet In A >Box, Netscape Navigator personal edition, or some other internet >software with a stack and dialer is upgraded to Win95, the win95 >installation may somehow disrupt the functioning of the winsock >or dialer. I've also heard that re-installing the application >will solve the problem. I've never seen the problem myself, >and don't know anything about any subpoena... > > --Jeff > >-- >Jeff Weinstein - Electronic Munitions Specialist My understanding is that Win '95 installs its winsock.dll in /windows/system, which is where a number of other Internet packages also install their winsock.dll. As their .dll is replaced by MS's, they cease to function (either correctly or at all). The problem is resolved by re-installing the original winsock.dll or configuring the Internet software to look elsewhere for it. Regards, Mark Neely ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

1 0

Tricky Netscape Security Hole
by drozone＠winternet.com 17 Dec '03

17 Dec '03

Yes it's full of headers, but it's the complete, unexpurgated version. If this theory is correct, this IS FAR WORSE THAN A 40 bit key. I saw the livescript on the source code. I use 1.22 for image stability right now, though. Yes it's a came from, a came from, a came from kinda deal, but in the interest of security brevity it "seems real enough" to me. Love Always, Carol Anne >Posted-Date: Mon, 4 Dec 1995 12:57:21 -0600 >X-Sender: jeff(a)cyborganic.com >Mime-Version: 1.0 >Date: Mon, 4 Dec 1995 10:51:56 -0700 >To: cybernauts-l(a)netcom.com >From: foodie(a)netcom.com (We're a Comglomerate) (by way of jeff(a)cyborganic.com > (Jeffrey Logsdon)) >Subject: Tricky Netscape Security Hole > >Anybody else see this happening? > >Eternal Vigilance, and all that. > >- ------- Start of forwarded message ------- >>From: Scott Weston <scott(a)tripleg.com.au> >>Subject: Netscape 2.0b2 allows for invasion of privacy >>Newsgroups: aus.net.announce,comp.privacy >>Date: Fri, 01 Dec 1995 11:09:06 +1100 > >Hi 'Net Dwellers, > >First off - I've posted this before (however not to this group) and only >got a response from the Netscape Corp. They were glad I found the >problem and said that they would fix it, however I feel that people >should know about it. Also I would like people to help me spread this >document around, i.e. if you know of a newsgroup (or people) that would >find this interesting then please re-postit. > >On with the problem... > >I've recently got hold of the latest netscape, and was (at first) very >excited about the new "LiveScripts" that it supports. If people don't >yet know - these "LiveScripts" allow you to put small programs into your >web page that is then executed by the Netscape client. There is no >DIRECT way for these programs to send information back to the owner of >the web page, however I was able to do it in a not-so-direct way. > >The "LiveScript" that I wrote extracts ALL the history of the current >netscape window. By history I mean ALL the pages that you have visited >to get to my page, it then generates a string of these and forces the >Netscape client to load a URL that is a CGI script with the QUERY_STRING >set to the users History. The CGI script then adds this information >to a log file. Now if this hasn't quite CLICKED yet lets do a little >example. > >Johnny Mnemonic starts up his newly acquired version of Netscape2.0b2 >to start his daily "surf" session. First he decides to check his CD-NOW >purchase and uses the handy Auto-Login URL. Then he decides to go to >Lycos and do a search. In his search he find my page, which he decides >to visit. Suddenly he is transported, not to my main page but to one >of my CGI scripts, which in turn happens to have ALL the URL's he just >been to in it. This means that in my log will be: > > - the URL to use to get into CD-NOW as Johnny Mnemonic, including > username and password. > - The exact search params he used on Lycos (i.e. exactly what he > searched for) > - plus any other places he happened to visit. > >I do this in a way that the user will KNOW that it has happened and >will _hopefully_ email Netscape and tell them they are NOT impressed. >But it would be EASY for me to change the CGI script so that the user >is unaware that it has actually happened, unless they closely examine >their URL history (in fact they'll probably just think its a netscape >bug). > > >If you're skeptical about this then do the test yourself. Get netscape >2.0b2 and do some normal surfing, and then go to Lycos. Do a search for: > > scotts car boot sale > >which should return the URL - http://www.tripleg.com.au/staff/scott > >Click on the URL and sit back an watch. First my main page will show up >but a little while later you should be transported to a CGI bin script >that will show you your URL history. > >I have tested this with both the Linux 2.0b2, and Solaris 2.0b2 versions >and both have done the same thing. I would be interested in knowing if >it happens for ALL versions of Netscape2.0b2. The log file does log >the User Agent (i.e. the name of the platform you are using) so by simply >going to the page I will know that your version of Netscape is also >open to this form of attack. > >Currently I can find no way to configure Netscape2.0b2 to NOT run >LiveScripts - and at the very least this option should be quickly >added to the next version of netscape to be released. But a far >better solution (IMHO) would be for netscape to pop up a window before >running the LiveScript and let you know what the LiveScript wants access >to, e.g. if it only wants to print out the current time then that's >OK, but if it wants to read my history list and then transport me to >a CGI script and add me to a logfile then maybe I would say NO. > >I think I've said enough.... > >If you've got any further questions, or want some more information just >email me : scott(a)tripleg.com.au > >- -- >Scott. > >Quote from a car accident insurance claim: "I told the police that I was >not injured, but on removing my hat, I found that I had a skull fracture." >- ------- End of forwarded message ------- > > >------------------------------ ------------------------------------------------------------ Thaddeus "Doc" Ozone <http://www.winternet.com/~drozone/> "Specialization is for insects." -RAH "I yam what I yam and that's all what I yam!" -Popeye

2 1

Re: No matter where you go, there they are.
by jim bell 17 Dec '03

17 Dec '03

At 07:48 PM 4/11/96 GMT+01DST, Powers Glenn wrote: >- It's called "S/A" (Selective Availability) which is the NWO term for adding >- errors that "authorized" users can remove. (Not to be confused with A/S, or >- anti-spoofing) It was originally intended to be turned on in wartime to >- deny the enemy accurate fixes, but during the Gulf War military GPS >- receivers were so scarce that the soldiers had to use commercial products, >- so the S/A actually was turned OFF then! >- >- Since then, pressure has been building to turn off S/A, since its usefulness >- is nearly zero. Even so, the amplitude of S/A errors are only a little >- larger than natural errors caused by satellite timing errors, atmospheric >- propagation variations, etc. The result is that DGPS is useful, which is >- (more or less) a fixed antenna and GPS system which knows where it is, and >- subtracts where it "seems" to be by GPS every second, and broadcasts the >- resulting error data on some terrestrial system to receivers locally. The >- result is errors down to the 1-meter level and even lower. That system >- compensates for both natural errors and S/A, so the whole purpose of having >- S/A is negated. Eventually S/A will probably be turned off permanently, but >- even then we'll want to continue to use DGPS systems. > > Close, but not quite: >S/A is an ADJUSTABLE variable, not on/off. Huh? You sound like you're trying to correct me, but you're not. I'm already aware that the magnitude of S/A is adjustable; nothing I've said above contradicts this. >it can reduce accuracy to 10 meters or 100 meters or whatever. For ordinary C/A code (the kind civilians are allowed to use) it can't "reduce accuracy to 10 meters." The minimal error in C/A mode is based on atmospheric propagation and other errors. Adjusting S/A down or off can eliminate the ADDED error, not reduce it below C/A's normal minimum RMS value. >It's a DoD term, not NWO term. I was being a bit facetious. Nevertheless, my implication was correct: The term is "selective availability" and it was specifically chosen to sound "positive" rather than "negative." (I can't tell you exactly which issue of GPS World magazine mentioned this, but I've read every copy since it was started a few years ago. It was probably in this magazine. It would have been more accurate, I suppose, to call this "Newspeak.") > The "this is where you really are" percision location (forgot >the designation off hand) is ENCRYPTED (yes, there is crypto >revelance here...) in the data stream from the satellites. It's called "PPS," for "Precise positioning Service." Check the most recent issue of GPS World for an article on making that even more accurate. Nevertheless, even PPS is only accurate to about +/- 2 meters; DGPS is easily accurate to 1 meter, and I've seen ads that talk about 0.15 meter accuracy with differential GPS in C/A mode. > The difference S/A makes is on the order of magnitude, therefore not >"useless." That depends on what you compare it to. If you compare it to non-differential, C/A code signal, it turns +/- 25 meter (approx, of course) errors to upwards of +/- 100 meter errors, although as I understand it S/A is normally toned down to about +/- 50 meters. BTW, I don't doubt that DoD has the technical ability to increase S/A even beyond +/- 100 meters, but that would be a pointless exercise. It would also strongly piss off the average civilian GPS user, and since by far the largest number of GPS users are now civilian (and this number is growing rapidly) the DoD knows which side of its bread is buttered. And using DGPS, the effect of S/A is essentially nil, since both it and most "natural" (unintentional) errors are cancelled out. So, what part of "useless" do you not understand? Please note that I didn't say it had no effect, merely that it was "useless." As in, no militarily significant effect. If you still disagree, please formulate a plausible (and, ideally, a PROBABLE) scenario under which the presence of S/A achieves a military benefit based on a rational view of whichever "enemy" you choose. Since DGPS receivers are available for well under $1000, you're going to have to hypothesize a poverty-stricken enemy indeed. >It should be pointed out that different regions of the >earth can have different degrees of accuracy based on the S/A system. > I doubt S/A will ever be turned off, but this is my opinion. Just a couple of days ago, I saw a note HERE reporting that Clinton had backed down (his normal behavior, interestingly!) and had decided to turn off S/A. I haven't seen any confirmation of this claim, but then I haven't looked either. If that report was correct, your opinion is already wrong. I am fully aware that it could later be turned back on, if there was a genuine reason to do so. This would be in line with the original intent behind S/A, to turn it on only when there was some real reasons to do so. Why they did not adopt this planned mode years ago, I don't know. >I know Jim's opinion. Discussion of this point is pointless. In other words, "Don't confuse me with the facts." > DGPS transmission are made from a multiple single points, which >(to the best of my knowledge) are not networked. > glenn That's only partially true. There is nothing to prevent the world-wide distribution of a data stream which represents the complete differential correction data for GPS, broadcast from multiple locations by FM subcarrier, idle cell-phone site, HF, pager channels, or other. In fact, it has been argued that it should be transmitted, in the band of the GPS signals(so that a separate differential antenna is not required), from satellites, with the receivers built into GPS units, so that it would be available to everyone no matter where he is. The attraction of this system, from a government/military standpoint, is that it would tend to foster dependance on this correction system by the average GPS user, and would tend to deter development of DGPS stations independent of the government. That means that the government would actually be able to keep the "S/A advantage": When it wants accuracies to be degraded, they will be. Its current policy, however, practically guarantees that DGPS stations will be broadcasting in every major population center within just a few years. Isn't it a good thing that government is so (CDA alert!) fucking stupid? Jim "He only talks about one subject" Bell jimbell(a)pacifier.com

1 0

The "Future" Fallacy
by Duncan Frissell 17 Dec '03

17 Dec '03

Bill Gates (like Mister Newt before him) committed what I call the Future Fallacy in "The Road Ahead." Page 106. "Soon any child old enough to use a computer will be able to transmit coded messages that no government on earth will find easy to decipher." DCF "Term limits aren't enough. We need jail." -- PJ

1 0

USENIX Conference.
by loki＠obscura.com 17 Dec '03

17 Dec '03

USENIX is in San Diego this year so I will be attending. I hope to see some of you there. If you will be going, please drop me a note. If there are enough of us I will try to set up a BOF (birds of a feather) session for cypherpunk / remailer discussions. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Joining The Mailing List
by Dave Turner 17 Dec '03

17 Dec '03

Cypherpunks, Would it be possible to include me on your current mailin list. Thanks Dave.

2 1

Re: WARNING: sting via remailer!
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

[ I see that the original has been forwarded to cypherpunks, so I'll also send my response there. -russ ] Boffo writes: > I was in the federal building coffee shop in Reston, Va. yesterday > when I overheard a conversation between what appeared to be two FBI agents > discussing a sting operation involving Mixmaster. Hearing the word > "mixmaster" naturally caused my ears to perk up and I listened further. > > It appears that the FBI has coerced a mixmaster remailer operator > into cooperating with them in a sting operation to catch remailers when > they forward email pertaining to pornography, pedophilia, and copy-written > software. Uh-oh! I'd better shut down my remailer, but fast, based on an unsubstantiated rumor. Especially one that makes little sense. Why do you need a sting? All you have to do is use a single remailer, and send the mail from yourself, to yourself. You know the source, destination, and who handled it. IF a court can be convinced that forwarding email containing illegal materials is the same as asking to receive email containing illegal materials, then ALL of our butts are toast. > My questions are a) is it possible to perform this type of > monitoring on a mixmaster remailer and, b) what is the identity of the > cooperating remailer operator? > > This concerns me greatly as I use remailers to privatize my > important email regularly and I don't want my identity or my email > compromised because of a "spook in cypherpunks clothing". You fool. If you use remailers regularly, then YOU ARE KNOWN TO THE SPOOKS. Face facts. We know that the FBI spends a minimum of $10,000,000 each year (count the wiretaps, multiply by agents and do the math) just for telephone wiretaps. Computer wiretaps are a LOT CHEAPER. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | Flushing, NY. Not just a suburb, Potsdam, NY 13676 | +1 315 268 9201 FAX | it's a good idea in general.

1 0

[Mix-L] WARNING: sting via remailer! (fwd)
by Bryan Strawser 17 Dec '03

17 Dec '03

Forwarded message: > From owner-mix-l(a)alpha.jpunix.com Tue Dec 5 09:03:10 1995 > Date: Tue, 5 Dec 1995 07:55:21 -0600 (CST) > Message-Id: <199512051355.HAA12202(a)alpha.jpunix.com> > To: mix-l(a)vishnu.alias.net, remailer-operators(a)c2.org, > mail2news(a)utopia.hacktic.nl > Newsgroups: alt.privacy, alt.privacy.anon-server, alt.security > From: "Mr. Boffo" <mixmaster(a)vishnu.alias.net> > X-Comment1: This message did not originate from the > X-Comment2: above address. It was automatically remailed > X-Comment3: by an anonymous mail service. Please report > X-Comment4: problems or inappropriate use to > X-Comment5: <complaints(a)vishnu.alias.net> > Subject: [Mix-L] WARNING: sting via remailer! > Sender: owner-mix-l(a)jpunix.com > Precedence: bulk > > I was in the federal building coffee shop in Reston, Va. yesterday > when I overheard a conversation between what appeared to be two FBI agents > discussing a sting operation involving Mixmaster. Hearing the word > "mixmaster" naturally caused my ears to perk up and I listened further. > > It appears that the FBI has coerced a mixmaster remailer operator > into cooperating with them in a sting operation to catch remailers when > they forward email pertaining to pornography, pedophilia, and copy-written > software. > > My questions are a) is it possible to perform this type of > monitoring on a mixmaster remailer and, b) what is the identity of the > cooperating remailer operator? > > This concerns me greatly as I use remailers to privatize my > important email regularly and I don't want my identity or my email > compromised because of a "spook in cypherpunks clothing". > -- Bryan Strawser, Indiana University, Bloomington, USA Remember Waco bstrawse(a)indiana.edu http://copper.ucs.indiana.edu/~bstrawse

3 2

Re: another fbi prosecution
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:30 AM 12/5/95 -0500, you wrote: > sophomore Dominick LaScala was charged last week in federal court with two > counts of computer fraud. I thought fraud was obtaining something of value by false pretenses or uttering a false document or something. Doesn't sound like fraud to me. DCF

2 1